FedGovContracts.com

Panoptic Enterprises' FEDERAL CONTRACTS DISPATCH

DATE: April 1, 2002

SUBJECT: Department of Energy Acquisition Regulation (DEAR); Assessment of Civil Penalties for Classified Information Security Violations

SOURCE: Federal Register, April 1, 2002, Vol. 67, No. 62, page 15339

AGENCIES: Department of Energy (DOE)

ACTION: Notice of Proposed Rulemaking (NPRM) and Notice of Public Hearing

SYNOPSIS: DOE is proposing regulations to implement Section 234B of the Atomic Energy Act of 1954, which was added by Section 3147 of the National Defense Authorization Act for Fiscal Year 2000 (Public Law 106-65). Section 234B subjects contractors and others working for DOE to civil penalties for violations of DOE rules, regulations, and orders regarding the safeguarding and security of "Restricted Data" and other classified information.

EDITOR'S NOTE: For more on a recent revision of the DOE Acquisition Regulation (DEAR) to implement Executive Order 12829, National Industrial Security Program (NISP), see the March 28, 2002, FEDERAL CONTRACTS DISPATCH "Department of Energy Acquisition Regulation (DEAR); National Industrial Security Program."

DATES: Seven copies of comments are to be submitted no later than July 1, 2002. Public hearings will be held in Las Vegas, NV on May 22, 2002, from 9:30 a.m. until 12:30 p.m., and in Washington, DC on May 29, 2002, from 9:30 a.m. until 12:30 p.m. Requests to speak at the Las Vegas hearing must be submitted no later than May 15, 2002, and requests to speak at the Washington, DC hearing must be submitted no later than May 22, 2002. Requests to make oral presentations should contain a telephone number where the requester may be contacted prior to the hearing. Speakers are requested to submit seven copies of their statement to DOE at the hearings.

ADDRESSES: Address comments to Geralyn C. Praskievicz, Office of Security, SO-1, Docket No. SO-RM-00-01, U.S. Department of Energy, 1000 Independence Ave., SW, Washington, DC 20585.

The public hearings will be held at the U.S. Department of Energy, National Nuclear Security Administration, Nevada Operations Office, 232 Energy Way, Room A107, Las Vegas, NV, and at the U.S. Department of Energy, James Forrestal Building, 1000 Independence Avenue SW, Room GE-086, Washington, DC. DOE reserves the right to select the persons to be heard at the hearings, to schedule their respective presentations, and to establish the procedures governing the conduct of the hearings. The length of each presentation is limited to fifteen minutes. These will not be judicial-type hearings. Questions may be asked only by those conducting the hearing.

FOR FURTHER INFORMATION CONTACT: Geralyn Praskievicz, Office of Security, SO-1, U.S. Department of Energy, 1000 Independence Ave., SW, Washington, DC 20585, 202-586-4451; or Jo Ann Williams, Office of General Counsel, GC-53, U.S. Department of Energy, 1000 Independence Ave., SW, Washington, DC 20585, 202-586-6899.

SUPPLEMENTAL INFORMATION: Subsection a. of new Section 234B of the Atomic Energy Act provides that any person who (1) has entered into a contract or agreement with DOE, or a subcontract or subagreement thereto, and (2) violates (or whose employee violates) any applicable rule, regulation, or order prescribed or otherwise issued by the secretary of energy in accordance with the Atomic Energy Act relating to the safeguarding or security of Restricted Data or other classified or "sensitive information" is be subject to a civil penalty not to exceed $100,000 for each such violation.

DOE is proposing to establish a new Part 824 in Title 10 of the Code of Federal Regulations (CFR) to implement Subsection a. and all other subsections of Section 234B of Section 234B of the Atomic Energy Act, (except Subsection b. -- see "EDITOR'S NOTE" below) with respect to contractors of DOE, including those of the National Nuclear Security Administration (NNSA) (which was established as an agency within DOE under Public Law 106-65). The following are the contents of the proposed 10 CFR 824, Procedural Rules for the Assessment of Civil Penalties For Classified Information Security Violations:

The following explains the provisions of the three most significant provisions of 10 CFR Part 824:

• Section 824.2, Applicability:
  
  
  • Paragraph (a) would state that "these regulations apply to any entity that is subject to DOE security requirements for the protection of classified information."
    
    
  • Paragraph (b) would state that DOE may not assess any civil penalty against "entities (including subcontractors and suppliers thereto) specified at Subsection d. of Section 234A of the Atomic Energy Act of 1954; and any nonprofit educational institution under the United States Internal Revenue Code", and then not until the entity or nonprofit education institution "enters into a new contract with DOE or an extension of a current contract with DOE..." Paragraph (b) would limit the total amount of civil penalties assessed against an entity or nonprofit education institution to "the total amount of fees paid by the DOE to that entity in that fiscal year..."
    
    Subsection d. of Section 234A sets limitations on civil penalties assessed against seven specified non-profit entities for violations regarding nuclear safety. The statute provides that no civil penalty may be assessed until the entity enters into a new contract with DOE or an extension of a current contract with DOE. The statute also limits the total amount of civil penalties assessed against these entities in any fiscal year to the total amount of fees paid to that entity in that fiscal year. Also, the limitations applicable to these seven entities apply to their subcontractors and suppliers regardless of whether they are for-profit or non-profit.
    
    DOE has determined, as a matter of discretion, to extend the cap on civil penalties assessed on the seven non-profit entities to any non-profit educational institution under the United States Internal Revenue Code (DOE exercised similar discretionary authority for educational non-profit institutions in 10 CFR Part 820 with respect to automatic remission from civil penalties for nuclear safety violations). DOE believes these other non-profit entities should receive uniform treatment concerning civil penalties. However, the for-profit subcontractors and suppliers of these other non-profits would not have their civil penalties limited to fee as in the case of the for-profit subcontractors and for-profit suppliers of the seven named entities. Also, as a matter of DOE discretion, these other non-profit entities would not be subject to civil penalties until they enter into a new contract with DOE or an extension of a current contract.
    
    Finally, the fee that represents the cap for civil penalties of non-profits will be determined in accordance with the provisions of the specific contracts covered by the limitation on non-profits.
    
    
  • Paragraph (c) would state that "no civil penalty may be assessed against an individual employee of a contractor or any other entity which enters into an agreement with DOE." This is included because Subsection a. of Section 234B provides that a contractor or other entity that has entered into an agreement or subagreements with DOE is liable for violations of its employees. Consequently, Section 824.2 does not provide for the assessment of any civil penalties against individual employees.
  
  
• Section 842.3, Definitions, and Section 842.4, Civil Penalties: DOE proposes applying civil penalties only to violations of requirements for the protection of classified information. Classified information defined by Section 842.2 as "'Restricted Data' and 'Formerly Restricted Data' protected against unauthorized disclosure pursuant to the [Atomic Energy] Act and 'National Security Information' protected against unauthorized disclosure under Executive Order 12958 (April 17, 1995) or any predecessor or successor executive order." Although Section 234B refers to "sensitive information," DOE does not employ this term in the proposed rule because: (1) neither the statute nor its legislative history defines the term; (2) there is no commonly accepted definition of "sensitive information" within DOE or the Executive Branch; (3) the legislative history indicates that Congress was concerned with unauthorized disclosures of classified information; and (4) the only category of unclassified information that might merit inclusion in a regulation imposing civil penalties is "Unclassified Controlled Nuclear Information" (UCNI), a category of unclassified government information concerning atomic energy defense programs established by Section 148 of the Atomic Energy Act of 1954 (42 U.S.C. 2168). DOE implemented the provisions of Section 148 in regulations contained in 10 CFR Part 1017, and those regulations provide that any person who violates a regulation or order issued under Section 148 shall be subject to a civil penalty not to exceed $100,000. Since Part 1017 already imposes the same civil monetary penalty for unauthorized dissemination of UCNI as the "not to exceed $100,000" penalty specified in Section 3147, DOE decided it is unnecessary to include UCNI in regulations implementing Section 3147.

  Therefore, proposed Section 824.4 states that the "not to exceed $100,000" civil penalty will apply only for violations of: (1) specific DOE regulations related to classified information security presently in the CFR (10 CFR Part 1016, Safeguarding of Restricted Data; 10 CFR Part 1045, Nuclear Classification and Declassification; and 10 CFR Part 1046, Physical Protection of Security Interests); (2) "any other DOE rule, regulation or order related to the safeguarding or security of classified information that specifically indicates that violation of its provisions may result in a civil penalty pursuant to Subsection a. of Section 234B of the [Atomic Energy] Act; and (3) compliance orders issued by the secretary of energy in accordance with proposed paragraph (b) Section 824.4 ("if, without violating any regulation listed in paragraph (a) [above], a person by an act or omission jeopardizes the security of classified information, the secretary may issue a compliance order to that person requiring the person to take corrective action and notifying the person that violation of the compliance order is subject to a notice of violation and assessment of a civil penalty"). The regulations on compliance orders are modeled after a similar mechanism in 10 CFR Part 820, which are the regulations implementing procedures for Section 234A of the Atomic Energy Act of 1954 with respect to nuclear safety.

  EDITOR'S NOTE: Subsection b. of Section 234B requires that each DOE contract contain provisions which provide an appropriate reduction in the fees or amounts paid to the contractor under the contract in the event of a violation by the contractor or contractor employee of any rule, regulation, or order relating to the safeguarding or security of Restricted Data or other classified or sensitive information.

  On February 1, 2001, DOE published an NPRM to amend the DEAR to implement Subsection b. of Section 234B (see the February 1, 2001, FEDERAL CONTRACTS DISPATCH "Department of Energy Acquisition Regulation (DEAR); Conditional Payment of Fee, Profit, and Other Incentives"). Some of the commenters responding to that NPRM assumed that the procurement rulemaking was intended to address all of the provisions in Section 234B. The February 1, 2001, NPRM was only intended to address Subsection b. This April 1, 2002, NPRM addresses Subsection a. and all other subsections of Section 234B except Subsection b.

  FOR FURTHER INFORMATION CONTACT: Panoptic Enterprises at 703-451-5953 or by e-mail to Panoptic@FedGovContracts.com.

  Copyright 2002 by Panoptic Enterprises. All Rights Reserved.

  Return to the Dispatches Library.

  Return to the Main Page.